General
-
Target
a42865d911ea4df9331b1f440a3c88936caadaed341ee3fd2ffee58436c1ba4e
-
Size
669KB
-
Sample
240330-bnf6esee57
-
MD5
fafd92db507c1863735ab383ae38f02e
-
SHA1
96939402ae7616b79ec98e1ce9bd6e74613c95ac
-
SHA256
a42865d911ea4df9331b1f440a3c88936caadaed341ee3fd2ffee58436c1ba4e
-
SHA512
6a40a726fa7c432cbb3e197a6f6b44b3c313f036ec7d3b4378dee7dc771e3f070c3d4f6d44e153d63cbd8d2cc50a2e3c1334fc1d4e2ccf8b36b98193bd61b59f
-
SSDEEP
12288:mFLK1DSKw+bEi/LsdatSrqfLTHWsnt3BRnzSwRe9nICPO:mFiDSKZDSaUrqja47nWaeJnPO
Static task
static1
Behavioral task
behavioral1
Sample
a42865d911ea4df9331b1f440a3c88936caadaed341ee3fd2ffee58436c1ba4e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a42865d911ea4df9331b1f440a3c88936caadaed341ee3fd2ffee58436c1ba4e.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
@BPkIlloCGraceD7@1 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
@BPkIlloCGraceD7@1
Targets
-
-
Target
a42865d911ea4df9331b1f440a3c88936caadaed341ee3fd2ffee58436c1ba4e
-
Size
669KB
-
MD5
fafd92db507c1863735ab383ae38f02e
-
SHA1
96939402ae7616b79ec98e1ce9bd6e74613c95ac
-
SHA256
a42865d911ea4df9331b1f440a3c88936caadaed341ee3fd2ffee58436c1ba4e
-
SHA512
6a40a726fa7c432cbb3e197a6f6b44b3c313f036ec7d3b4378dee7dc771e3f070c3d4f6d44e153d63cbd8d2cc50a2e3c1334fc1d4e2ccf8b36b98193bd61b59f
-
SSDEEP
12288:mFLK1DSKw+bEi/LsdatSrqfLTHWsnt3BRnzSwRe9nICPO:mFiDSKZDSaUrqja47nWaeJnPO
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-